Skip to content

Return byte string for undefined BGP generic transitive extended communities sub-types#4745

Merged
gpotter2 merged 1 commit into
secdev:masterfrom
tonusoo:master
May 22, 2025
Merged

Return byte string for undefined BGP generic transitive extended communities sub-types#4745
gpotter2 merged 1 commit into
secdev:masterfrom
tonusoo:master

Conversation

@tonusoo
Copy link
Copy Markdown
Contributor

@tonusoo tonusoo commented May 21, 2025

Scapy currently fails to decode a BGP UPDATE message if it contains a generic transitive extended community with an undefined sub-type. Example:

>>> BGPHeader(bytes.fromhex("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0068020000004D4001010040020A020200000B62000056374003045051C02E80040400008A60C008100B62019A0B62057A0B6209630B620D48C010180005000056370200\
80000000000005008001C71B5402000018C71B54"))
<BGPHeader  marker=0xffffffffffffffffffffffffffffffff len=104 type=UPDATE |<Raw  load=b'\x00\x00\x00M@\x01\x01\x00@\x02\n\x02\x02\x00\x00\x0bb\x00\x00V7@\x03\x04PQ\xc0.\x80\x04\x04\x00\x00\x8a`\xc0\x08\x10\x0bb\x01\x9a\x0bb\x05z\x0bb\tc\x0bb\rH\xc0\x10\x18\x00\x05\x00\x00V7\x02\x00\x80\x00\x00\x00\x00\x00\x05\x00\x80\x01\xc7\x1bT\x02\x00\x00\x18\xc7\x1bT' |>>
>>>

Hex string above represents a BGP UPDATE message containing two generic transitive extended communities (type 0x80) and both have a sub-type which does not get handled in m2i() method of _ExtCommValuePacketField() class.

With this patch, Scapy successfully decodes the same BGP UPDATE message and returns a byte string for the value of the extended community:

>>> BGPHeader(bytes.fromhex("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0068020000004D4001010040020A020200000B62000056374003045051C02E80040400008A60C008100B62019A0B62057A0B6209630B620D48C010180005000056370200\
80000000000005008001C71B5402000018C71B54")).payload.path_attr[-1].show()
###[ BGPPathAttr ]###
  type_flags= Transitive+Optional
  type_code = EXTENDED COMMUNITIES
  attr_len  = 24
  \attribute \
   |###[ EXTENDED_COMMUNITIES ]###
   |  \extended_communities\
   |   |###[ EXTENDED_COMMUNITY ]###
   |   |  type_high = Transitive Two-Octet AS-Specific Extended Community
   |   |  type_low  = OSPF Domain Identifier
   |   |  \value     \
   |   |   |###[ Two-Octet AS Specific Extended Community ]###
   |   |   |  global_administrator= 0
   |   |   |  local_administrator= 1446445568
   |   |###[ EXTENDED_COMMUNITY ]###
   |   |  type_high = Generic Transitive Experimental Use Extended Community
   |   |  type_low  = OSPF Route Type (deprecated)
   |   |  \value     \
   |   |   |###[ Raw ]###
   |   |   |  load      = b'\x00\x00\x00\x00\x05\x00'
   |   |###[ EXTENDED_COMMUNITY ]###
   |   |  type_high = Generic Transitive Experimental Use Extended Community
   |   |  type_low  = OSPF Router ID (deprecated)
   |   |  \value     \
   |   |   |###[ Raw ]###
   |   |   |  load      = b'\xc7\x1bT\x02\x00\x00'

>>>

This leaves it up to the application using the Scapy library to further process those values, if needed.

Copy link
Copy Markdown
Member

@gpotter2 gpotter2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR.

@codecov
Copy link
Copy Markdown

codecov Bot commented May 22, 2025

Codecov Report

Attention: Patch coverage is 0% with 1 line in your changes missing coverage. Please review.

Project coverage is 82.20%. Comparing base (57db4aa) to head (4de8cc2).
Report is 2 commits behind head on master.

Files with missing lines Patch % Lines
scapy/contrib/bgp.py 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4745      +/-   ##
==========================================
- Coverage   82.20%   82.20%   -0.01%     
==========================================
  Files         361      361              
  Lines       87195    87196       +1     
==========================================
- Hits        71680    71679       -1     
- Misses      15515    15517       +2     
Files with missing lines Coverage Δ
scapy/contrib/bgp.py 91.92% <0.00%> (-0.13%) ⬇️

... and 6 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gpotter2 gpotter2 merged commit 7ea97d7 into secdev:master May 22, 2025
22 of 24 checks passed
@gpotter2 gpotter2 added this to the 2.7.0 milestone Nov 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants